761 matches found
ZH Yandex Map, 6.1.1.0, SQL Injection
ZH Yandex Map, 6.1.1.0 and previous versions, SQL Injection Resolution: update to 6.2.0.0 Update notice: http://zhuk.cc/2017/10/05/zh-yandexmap-security-update/...
Keen IT Photo Contest, 1.0.2, SQL Injection
Keen IT Photo Contest, 1.0.2, SQL Injection...
Event Registration Pro,4.1.3,SQL Injection
Event Registration Pro, 4.1.3 and previous, SQL Injection Resolution: update to version 4.1.4 Update notice: https://www.joomlashowroom.com/blog/event-registration-pro-4-1-4-security-release...
JoomRecipe,1.0.3,SQL Injection
JoomRecipe ,1.0.3,SQL Injection UpdateNotice URL https://www.joomboost.com/blog-updates/entry/joomrecipe-version-1-0-4-security-announcement.html changelog Changelog Url https://www.joomboost.com/components-changelogs/60-joomrecipe-changelog.html...
JMultipleHotelReservation, 6.0.3, SQL Injection
JMultipleHotelReservation by CMS Junkie, 6.0.3, SQL Injection Resolution: Update to 6.0.4 Update notice: http://www.cmsjunkie.com/blog/joomla-hotel-reservation-6-0-4-release/...
Easy Youtube Gallery , 1.0.2,Information Disclosure
Easy Youtube Gallery , 1.0.2,Information Disclosure...
Huge IT Catalog,1.0.6,SQL Injection
Huge IT Catalog,1.0.6 and previous versions ,SQL Injection and XSS vulnerability Resolution: update to 1.0.8 Update notice: https://huge-it.com/joomla-extensions-security-notice/...
Spider random articles before 1.5.3
Spider random articles versions before 1.5.3 Resolution: update to 1.5.3 Update notice: https://web-dorado.com/products/joomla-random.html...
Memberhsip Pro, versions before 2.1.1
Joomdonation extensions, Information Disclosure Memberhsip Pro versions before 2.1.1 Resolution: update to 2.1.1 Update notice URL: http://joomdonation.com/forum/membership-pro/50512-membership-pro-version-2-1-1-released.html...
cckseblod 1.x Directory Traversal
comcckseblod aka seblod 1.x for Joomla 1.5 1.9.0 and all previous versions Directory Traversal Resolution: update to 1.9.1 Update notice: http://www.seblod.com/changelogs?sebchangelogproduct=cck1x Developer states that Seblod 3.x, the version compatible with Joomla 2.5 and 3, is not vulnerable...
SimpleImageUpload by Tuts4You, 1.2 and below, Other
SimpleImageUpload by Tuts4You, 1.2, Other...
pPGallery [plg_content_ppgallery], 4.315, XSS (Cross Site Scripting)
pPGallery plgcontentppgallery, 4.315, XSS Cross Site Scripting...
extplorer, 2.1.4 and below
extplorere, ID,DT, release of 2.1.5 http://extplorer.net/news/14...
[20260702] - Core - Incorrect Access Control in com_contact vcf download
An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...
[20260510] - Core - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
[20260506] - Core - Authenticated blind SQLi in com_finder
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for comfinder...
[20260304] - Core - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations...
rsmail
Extension: RSMail! Version: Old 1.22.26, 1.22.27, 1.22.28 / New 1.22.29 Update details: Versions affected 1.19.20 through 1.22.28. Self XSS allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted parameter. Fixed in 1.22.29 Update URL:...
LM-CUSTOM-ADMIN, , Other
Version: Old 2.7.3 / New 2.7.4 Update details: block cde php shellexec Update URL: https://lomart.fr/extensions-blog/38-modules-administrator/125-lm-custom-administrator Changelog URL:...
Google Maps by Reumer, 3.5, Malicious update
Google Maps by Reumer, from mapsplugin.com, version 3.5, malicious update Version 3.3 of this plugin is listed in the JED and appears to be clean. However once installed, the Joomla update manager prompts you to update this extension to a version 3.5 which is not officially published. This versio...
Price Alert for Virtuemart,3.0.4,SQL Injection
Price Alert for Virtuemart by WebOrange, 3.0.4 and all previous, SQL Injection...
Akeeba Backup, 5.5.1, various issues
Akeeba Backup, versions 5.5.1 and previous, various issues see developer's site for details Resolution: update to 5.5.2 Update notice: https://www.akeebabackup.com/component/ars/?view=Itemsid=2732...
J-Hotel Portal,6.0.2,SQL Injection
J-Hotel Portal by cmsjunkie.com, 6.0.2, SQL Injection...
Huge IT gallery,1.1.5,SQL Injection
Huge IT gallery,1.1.5,SQL Injection resolution: update to 1.1.9...
Form Maker before 3.6.0
Web Dorado Form Maker versions before 3.6.0 XSS Resolution: update to 3.6.0 Update notice: https://web-dorado.com/products/joomla-form.html...
Codels codehighlighter 1.4
Codels plgcontentcodehighlighter version 1.4 and previous. XSS Cross Site Scripting...
Cobalt,8.270
Cobalt, , DT/permissions developer update Notice updated http://www.mintjoomla.com/blog/item/279-update-cobalt-v-8-279-stable.html...
[20260706] - Core - XSS in com_installer
Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...
[20260708] - Core - XSS through language overrides
Improper validation leads to a generic XSS vector in the language override feature...
[20260703] - Core - XSS in MFA method management
Lack of validation leads to an XSS vulnerability in the MFA management views...
[20260502] - Core - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component...
[20260301] - Core - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...
phoc commander, varios,
Update to latest secure version https://www.phoca.cz/news/1384-phoca-commander-version-5-0-2-and-4-0-1-released...
rsblog
Extension: RSBlog! Version: Old 1.14.4, 1.14.5 / New 1.14.6 Update details: Versions affected 1.11.6 to 1.14.5 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the tag parameter. Fixed in 1.14.6 Update URL:...
HikaShop, 5.1.3, Other ACL
Update to Hikashop 5.1.4 . No other details on this exploit will be release...
Vik Rent Car 1.10 and previous
Vik Rent Car 1.10 and previous, SQL injection Resolution: update to 1.11 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...
Magic Deals Web by Jason Web Design,1.2.0,SQL Injection
Magic Deals Web by Jason Web Design, 1.2.0, SQL Injection...
One Vote,1.1.1,SQL Injection
One Vote by advcomsys.com, 1.1.1 and previous, SQL Injection resolution: update to 1.2.2 update notice: http://www.advcomsys.com/joomla-demos...
Huge IT Googlemaps,1.0.9,SQL Injection
Huge IT Googlemaps,1.0.9, Multiple SQL Injection vulnerabilities...
Joom Donation, versions before 4.1, Information Disclosure
Joomdonation extensions, Information Disclosure Joom Donation versions before 4.1 Resolution: update to 4.1 Update notice URL: http://joomdonation.com/forum/joom-donation/50513-joom-donation-version-4-1-released.html...
Spider Form Maker by Web-Dorado [com_formmaker],3.4 and lower
Spider Form Maker by Web-Dorado comformmaker,3.4 and lower,SQL Injection Developer statement This vulnerability was fixed in version 3.4.1 and above. The version 3.4.1 was released on 2014-09-10...
Events Booking, 1.6.7 and lower, (module: Search Events)
Events Booking 1.6.7 =Vulnerability: XSS Cross Site Scripting Extension Update Details This issue only affect the search module Search Events which comes with Events Booking. We released version 1.6.8 to address this issue...
[20260710] - Core - Incorrect Access Control in com_modules
An improper access check allows users to display a list of modules in the frontend...
[20260704] - Core - XSS in com_templates
Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...
[20260709] - Core - Incorrect Access Control in com_workflow
An improper access check allows unauthorized users to access workflow stage and transition information...
[20260508] - Core - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to comconfig webservice endpoints...
Joomanager, other
Joomanager from joomanager.com, 2.0.0 and previous versions users are advised to uninstall immediately...
UserExtranet,1.3.2,SQL Injection
UserExtranet by Beesto.com, 1.3.2 and previous, SQL Injection resolution: update to 1.3.3 update notice: http://www.beesto.com/forum/read.php?30,2085...